Fix up tests

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>

Author: egibs

pkg/programkind/programkind_test.go

@@ -49,7 +49,7 @@ func TestPath(t *testing.T) {
 		{"/etc/systemd/system/launcher.service", &FileType{MIME: "text/x-systemd", Ext: "service"}},
 		{"yarn-package.json", &FileType{MIME: "application/json", Ext: "json"}},
 		{"/home/yeti/.hidden/package.json", &FileType{MIME: "application/json", Ext: "json"}},
-		{"unknown.json", nil},
+		{"unknown.json", &FileType{MIME: "application/json", Ext: "json"}},
 	}
 	for _, tt := range tests {
 		t.Run(tt.in, func(t *testing.T) {

rules/c2/tool_transfer/exe_url.yara

@@ -5,6 +5,7 @@ rule http_url_with_exe: high {
   strings:
     $exe_url         = /https*:\/\/[\w\.]{0,160}[:\/\w\_\-\?\@=]{6,160}\.exe/
     $not_mongodb_404 = "https://docs.mongodb.com/manual/reference/method/Bulk.exe"
+    $not_elastic = "\"license\": \"Elastic License v2\""
 
   condition:
     any of ($exe*) and none of ($not*)
@@ -14,11 +15,14 @@ rule http_ip_url_with_exe: critical {
   meta:
     description = "accesses hardcoded executable endpoint via IP"
 
+
   strings:
     $exe_url = /https*:\/\/[\d\.\:\[\]]{8,64}[:\/\w\_\-\?\@=]{6,160}\.exe/
 
+    $not_elastic = "\"license\": \"Elastic License v2\""
+
   condition:
-    any of ($exe*)
+    any of ($exe*) and none of ($not*)
 }
 
 rule http_url_with_msi: high {
@@ -28,8 +32,10 @@ rule http_url_with_msi: high {
   strings:
     $exe_url = /https*:\/\/[\w\.]{0,160}[:\/\w\_\-\?\@=]{6,160}\.msi/
 
+    $not_elastic = "\"license\": \"Elastic License v2\""
+
   condition:
-    any of ($exe*)
+    any of ($exe*) and none of ($not*)
 }
 
 rule http_ip_url_with_msi: critical {
@@ -39,8 +45,10 @@ rule http_ip_url_with_msi: critical {
   strings:
     $exe_url = /https*:\/\/[\d\.\:\[\]]{8,64}[:\/\w\_\-\?\@=]{6,160}\.msi/
 
+    $not_elastic = "\"license\": \"Elastic License v2\""
+
   condition:
-    any of ($exe*)
+    any of ($exe*) and none of ($not*)
 }
 
 rule http_url_with_powershell: high {
@@ -50,8 +58,10 @@ rule http_url_with_powershell: high {
   strings:
     $exe_url = /https*:\/\/[\w\.]{0,160}[:\/\w\_\-\?\@=]{6,160}\.ps1/
 
+    $not_elastic = "\"license\": \"Elastic License v2\""
+
   condition:
-    any of ($exe*)
+    any of ($exe*) and none of ($not*)
 }
 
 rule http_ip_url_with_powershell: critical {
@@ -61,6 +71,8 @@ rule http_ip_url_with_powershell: critical {
   strings:
     $exe_url = /https*:\/\/[\d\.\:\[\]]{8,64}[:\/\w\_\-\?\@=]{6,160}\.ps1/
 
+    $not_elastic = "\"license\": \"Elastic License v2\""
+
   condition:
-    any of ($exe*)
+    any of ($exe*) and none of ($not*)
 }

rules/impact/remote_access/botnet.yara

@@ -32,6 +32,7 @@ rule botnet_high: high {
     $botnet        = "Botnet"
     $not_phishing  = "phishing"
     $not_keylogger = "keylogger"
+    $not_wikiticker_contribution = "Undid revision 680586363 by"
 
   condition:
     filesize < 20MB and any of ($bot*) and none of ($not*)

tests/linux/clean/kibana/2e29e96a-b67c-455a-afe4-de6183431d0d_111.json.simple

@@ -1,6 +1,5 @@
-# linux/clean/kibana/2e29e96a-b67c-455a-afe4-de6183431d0d_111.json: high
+# linux/clean/kibana/2e29e96a-b67c-455a-afe4-de6183431d0d_111.json: medium
 3P/sig_base/hacktool_strings_p0wnedshell: low
-c2/tool_transfer/exe_url: high
 c2/tool_transfer/os: low
 exec/shell/power: medium
 impact/infection/infected: medium

tests/linux/clean/kibana/951779c2-82ad-4a6c-82b8-296c1f691449_2.json.simple

@@ -1,6 +1,5 @@
-# linux/clean/kibana/951779c2-82ad-4a6c-82b8-296c1f691449_2.json: high
+# linux/clean/kibana/951779c2-82ad-4a6c-82b8-296c1f691449_2.json: medium
 3P/sig_base/p0wnedpotato: low
-c2/tool_transfer/exe_url: high
 c2/tool_transfer/os: low
 exec/shell/power: medium
 net/download: medium

tests/linux/clean/kibana/ac96ceb8-4399-4191-af1d-4feeac1f1f46_108.json.simple

@@ -1,7 +1,6 @@
-# linux/clean/kibana/ac96ceb8-4399-4191-af1d-4feeac1f1f46_108.json: high
+# linux/clean/kibana/ac96ceb8-4399-4191-af1d-4feeac1f1f46_108.json: medium
 3P/sig_base/hacktool_strings_p0wnedshell: low
 c2/addr/url: medium
-c2/tool_transfer/exe_url: high
 c2/tool_transfer/os: low
 credential/password: low
 exec/shell/power: medium

tests/linux/clean/wikiticker-2015-09-12-sampled.json.simple

@@ -1,4 +1,4 @@
-# linux/clean/wikiticker-2015-09-12-sampled.json: high
+# linux/clean/wikiticker-2015-09-12-sampled.json: medium
 anti-behavior/blocklist/user: medium
 anti-behavior/random_behavior: low
 c2/addr/ip: medium
@@ -12,7 +12,6 @@ fs/file/delete_forcibly: low
 fs/path/relative: medium
 impact/infection/worm: medium
 impact/remote_access/agent: medium
-impact/remote_access/botnet: high
 impact/remote_access/implant: medium
 impact/remote_access/trojan: medium
 net/download: medium